Default Rules
whac has 32 builtin rules. Disable or re-grade a rule with overrides. See
Layering Org Policy.
| ID | Severity | Kind | Description | Keywords |
|---|---|---|---|---|
AGE_SECRET_KEY |
CRITICAL | pattern | age encryption secret key | age-secret-key-1 |
ANTHROPIC_API_KEY |
CRITICAL | pattern | Anthropic API key | sk-ant- |
AWS_ACCESS_KEY_ID |
CRITICAL | pattern | AWS access key ID | akia asia abia acca |
AWS_SECRET_ACCESS_KEY |
CRITICAL | pattern | AWS secret access key | aws_secret secretaccesskey secret_access_key |
AZURE_CLIENT_SECRET |
HIGH | pattern | Microsoft Entra ID (Azure AD) client secret | q~ |
AZURE_STORAGE_ACCOUNT_KEY |
CRITICAL | pattern | Azure storage account key in a connection string | accountkey= |
DOCKER_CONFIG_AUTH |
HIGH | pattern | Registry credentials in a Docker config file | "auth" |
DOCKER_HUB_TOKEN |
HIGH | pattern | Docker Hub personal access token | dckr_pat_ |
GCP_API_KEY |
HIGH | pattern | Google Cloud API key | aiza |
GCP_SERVICE_ACCOUNT_KEY |
CRITICAL | pattern | Google Cloud service account private key in JSON | "private_key" |
GENERIC_API_KEY |
MEDIUM | pattern | High-entropy value assigned to an API key, token or secret name | api token secret |
GITHUB_TOKEN |
CRITICAL | pattern | GitHub personal access, OAuth, app or refresh token | ghp_ gho_ ghu_ ghs_ ghr_ github_pat_ |
GITLAB_TOKEN |
CRITICAL | pattern | GitLab personal, project or group access token | glpat- |
HEROKU_API_KEY |
HIGH | pattern | Heroku API key | heroku |
JWT |
MEDIUM | pattern | JSON Web Token | eyj |
NETRC_PASSWORD |
HIGH | pattern | Password in a netrc file | machine |
NPM_TOKEN |
CRITICAL | pattern | npm access token | npm_ |
OPENAI_API_KEY |
CRITICAL | pattern | OpenAI API key | t3blbkfj |
PRIVATE_KEY |
CRITICAL | pattern | PEM-encoded private key | private key----- |
PYPI_TOKEN |
CRITICAL | pattern | PyPI upload token | pypi-ageichlwas5vcmc |
SECRET_ASSIGNMENT |
MEDIUM | assignment | High-entropy value assigned to a secret-like key | secret token key passw pwd auth credential |
SENDGRID_API_KEY |
CRITICAL | pattern | SendGrid API key | sg. |
SENSITIVE_PATH |
HIGH | assignment | Value at a sensitive key path in a structured file | |
SESSION_TOKEN |
HIGH | assignment | Session or OAuth token in a structured credential file | |
SHOPIFY_TOKEN |
HIGH | pattern | Shopify access token or shared secret | shpat_ shpca_ shppa_ shpss_ |
SLACK_TOKEN |
CRITICAL | pattern | Slack bot, user or app token | xoxb- xoxp- xoxa- xoxo- xoxs- xoxr- |
SLACK_WEBHOOK_URL |
HIGH | pattern | Slack incoming webhook URL | hooks.slack.com/services/ |
STRIPE_SECRET_KEY |
CRITICAL | pattern | Stripe live secret or restricted key | sk_live_ rk_live_ |
TERRAFORM_CLOUD_TOKEN |
CRITICAL | pattern | HCP Terraform (Terraform Cloud) API token | .atlasv1. |
TWILIO_API_KEY |
HIGH | pattern | Twilio API key | twilio |
URL_CREDENTIALS |
HIGH | pattern | Password in a URL (user:password@host) | :// |
VAULT_TOKEN |
CRITICAL | pattern | HashiCorp Vault service, batch or recovery token | hvs. hvb. hvr. |
Sensitive paths
Section titled “Sensitive paths”SENSITIVE_PATH reports any value at these key paths in structured files.
| Key-path glob | Reason |
|---|---|
**.*passwd |
password values |
**.*password |
password values |